Skip to main content

Threat CenterThreat Center Release Notes

Table of Contents

Threat Center Features Introduced in 2025

January 2025

The following features were introduced in Threat Center in January 2025:

Feature

Description

Analytics Rules Detections

If you have the New-Scale SIEM, New-Scale Analytics, or New-Scale Fusion licenses, you can now investigate triggered analytics rules in Threat Center as detections.

An analytics rule in the threat timeline.

Risk Score Calculation with Behavioral Analytics

With Threat Detection Management on the Analytics and Fusion licenses, risk score calculations for alerts and cases are now based on behavioral analytics insights and more accurately reflect real risk. The analytics engine assigns detections a rarity score depending on how often Threat Detection Management rules trigger in your environment. Case and alert risk scores are calculated using a combination of detection rarity scores and certain confidence factors.

Automation Management in Threat Center

Threat Center is now more deeply integrated with Automation Management. You can now:

  • Manually run a playbook or action on a specific case or alert.

    threatcenter-actions-runaplaybook.png

  • View a history of Automation Management tools you've run on a specific case or alert.

    In the Overview tab under Automation, view the five most recently run playbooks and actions:

    threatcenter-2024releasenotes-overviewautomation.png

    Under the Automation tab, view the full history of all playbooks and actions run on a case or alert:

    threatcenter-2024releasenotes-automation.png

Manual Case Creation

You can now manually create a case from scratch, without associating it with an alert.

threatcenter-cases-createcase.png

Copilot Case Names

You can now better understand what a case represents and quickly decide which case to work on with AI-generated case names. Only cases converted from an alert have AI-generated case names.

Enhanced Entity Display

Entities are now displayed more intuitively. User entities are shown as their full name or email address. If neither information is available, user entities are shown as their username. Device entities are shown as their host name.

Device Entity Details

To better understand a device entity in the context of a case or alert, you can now view entity device details from Attack Surface Insights directly in Threat Center.